REUSE-WP-0023-T01: federation source -> access-engine; T02 needs operator

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 101414@bnt-lap001
Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6

registry/federation/local-repo-roster.yaml

@@ -206,8 +206,8 @@ repos:
   hub_registered: true
   publish_check: pass
   batch: null
-- slug: flex-auth
-  path: /home/worsch/flex-auth
+- slug: access-engine
+  path: /home/worsch/access-engine
   status: established
   capability_count: 1
   capability_status: has

registry/federation/sources.yaml

@@ -121,8 +121,8 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: flex-auth
-  url: https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml
+- repo: access-engine
+  url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge

registry/indexes/federated.yaml

@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-09-20'
+updated: '2026-09-30'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -73,10 +73,10 @@ sources:
   count: 3
   url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/feature-control.yaml
-- repo: flex-auth
+- repo: access-engine
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/flex-auth.yaml
+  url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
+  cache: registry/federation/cache/access-engine.yaml
 - repo: guide-board
   count: 1
   url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
@@ -408,9 +408,9 @@ capabilities:
   - flex-auth
   consumption_modes:
   - source module
-  source_repo: flex-auth
-  source_url: https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/flex-auth.yaml
+  source_repo: access-engine
+  source_url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/access-engine.yaml
 - id: capability.cmis.tck
   name: OpenCMIS Conformance-Preparation Extension
   summary: CMIS conformance-preparation extension for guide-board, keeping CMIS-specific

workplans/REUSE-WP-0023-access-engine-source-rename.md

@@ -45,7 +45,7 @@ index. Start T01 when `access-engine` serves the raw index.
 
 ```task
 id: REUSE-WP-0023-T01
-status: wait
+status: done
 flavor: residual
 priority: medium
 state_hub_task_id: "d97094d4-4cad-5b35-aa88-eb952215937a"
@@ -74,6 +74,8 @@ capability-semantic migration is authorized by this task.
 ```task
 id: REUSE-WP-0023-T02
 status: wait
+needs_human: true
+blocking_reason: "Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step."
 flavor: residual
 priority: medium
 state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a"
@@ -111,3 +113,14 @@ new raw index is available. The checked-in source and local roster still use
 is met. T02 remains blocked on T01; the hosted registration must follow the
 verified source migration. Resume these existing tasks when the canonical
 access-engine raw index is available and validates successfully.
+
+## T01 evidence — 2026-09-30
+
+FLEX-WP-0020 rename landed (access-engine, head b943d9a). Probe:
+`/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` returns 303 then 200.
+Changed `registry/federation/sources.yaml` (repo + URL) and
+`local-repo-roster.yaml` (slug + path ~/access-engine). Ran
+`reuse-surface federation compose --refresh`: 65 capabilities before and after;
+only `source_repo`/`source_url`/`source_index` of the one entry changed, capability
+identifier preserved. `reuse-surface validate` ok. Old `cache/flex-auth*` files are
+ignored cache and were left. T02 (hosted hub) handed to an operator.